Fix beta manifest fetch and guard force-install against stale manifests

[bharvey88]

Version: 26.7.8.6

What does this implement/fix?

Hardware testing surfaced two OTA bugs that combined into WiFi-eating downgrades:

• Beta manifest fetches always failed. GitHub release-asset URLs answer with a redirect whose signed Location header exceeds esp_http_client's 512-byte default rx buffer (HTTP_CLIENT: Out of buffer). Fixed with buffer_size_rx: 2048 on all images. Without this, beta-channel devices could neither refresh their manifest nor be offered updates.
• The Firmware Update button could install the wrong channel's image. update.perform(force) uses whatever manifest was last fetched successfully; with the fetch failing, pressing the button on Beta silently installed the cached Stable manifest - downgrading to the old pre-feature image, which also wiped saved settings (WiFi credentials included) on boot. The button now verifies the cached manifest URL matches the selected channel and variant before performing, and refuses with a clear log line otherwise.

Log evidence from the failing device:

[E] Failed to fetch manifest from .../releases/download/beta-fw/manifest-standard.json
[I] Starting update
[I] Connecting to: https://apolloautomation.github.io/MSR-1/firmware/apollo-msr-1-esp32c3.ota.bin

All five configs validate on ESPHome 2026.6.4. Needs a hardware re-test of the Beta force-install path once merged.

Types of changes

• Bugfix (fixed change that fixes an issue)
• New feature (thanks!)
• Breaking change (repair/feature that breaks existing functionality)
• Dependency Update - Does not publish
• Other - Does not publish
• Website of github readme file update - Does not publish
• Github workflows - Does not publish

Checklist / Checklijst:

• The code change has been tested and works locally
• The code change has not yet been tested

If user-visible functionality or configuration variables are added/modified:

• Added/updated documentation for the web page

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved firmware update reliability by preventing installs when the available update appears to be from a different release channel or device variant.
  • Increased network response buffer sizes to avoid download failures during large redirect responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 861a3b07-8ba7-4388-81df-3fec08d72c1e

📥 Commits

Reviewing files that changed from the base of the PR and between ddec791 and 3635ac7.

📒 Files selected for processing (4)

• Integrations/ESPHome/Core.yaml
• Integrations/ESPHome/MSR-1.yaml
• Integrations/ESPHome/MSR-1_BLE.yaml
• Integrations/ESPHome/MSR-1_Factory.yaml

---

Walkthrough

Bumps the ESPHome firmware version substitution and reworks the Firmware Update button to validate the cached OTA manifest's channel/variant against user selections before installing, instead of forcing an install unconditionally. Separately, increases http_request receive buffer size to 2048 across three MSR-1 device configs to prevent "Out of buffer" errors on GitHub redirect responses.

Changes

Firmware Update Logic

Layer / File(s)	Summary
Version bump and channel-aware OTA install Integrations/ESPHome/Core.yaml	Version substitution bumped from 26.7.8.5 to 26.7.8.6; Firmware Update button handler now checks cached firmware_url against selected firmware_channel/firmware_ble and skips install with a logged error on mismatch, otherwise calls perform(true).

HTTP Buffer Fix

Layer / File(s)	Summary
Increase http_request receive buffer Integrations/ESPHome/MSR-1.yaml, Integrations/ESPHome/MSR-1_BLE.yaml, Integrations/ESPHome/MSR-1_Factory.yaml	Adds buffer_size_rx: 2048 with explanatory comments to http_request config to prevent "HTTP_CLIENT: Out of buffer" errors from long redirect Location headers.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

• ApolloAutomation/MSR-1#73: Both PRs modify the version substitution in Core.yaml.
• ApolloAutomation/MSR-1#85: Both PRs bump substitutions.version in Core.yaml.
• ApolloAutomation/MSR-1#89: Both PRs modify the Firmware Channel/OTA flow in Core.yaml around channel switching and firmware update button behavior.

Suggested reviewers: TrevorSchirmer

Poem

A hop, a bump, a version anew,
The buffer grows so links get through,
No more "out of buffer" cries,
Firmware checks before it flies,
This bunny thumps with joy tonight! 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the two main changes: beta manifest fetch fixes and stale-manifest protection during force-install.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-beta-fetch-and-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}